@sema-agent/server 7.133.0 → 7.134.0

package/dist/plugins/local-session-store.js

@@ -1,5 +1,6 @@
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import { assertFirstOwnerWritable, forkOwnerOf } from "./session-ownership.js";
 import { FileSessionRepo, SessionError, StoredSession, validateEntriesForImport } from "@sema-agent/core";
 import { z } from "zod";
 import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
@@ -13,7 +14,7 @@ import { decodeInstructionSource, encodeInstructionSource, sameInstructionSource
 import { noteReplayInSessionOpenScope, openSessionForItself } from "../session-records-skipped-notice.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { buildObjectivePreview, isAttachmentFrame } from "../user-authored-text.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, } from "../session-sync-kernel.js";
+import { classifySyncRelationshipByIds, ownerCellIs, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, } from "../session-sync-kernel.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const isNotFound = (e) => e instanceof SessionError && e.code === "not_found";
 const SESSION_OBJECTIVE_PREVIEW_CHARS = 200;
@@ -459,6 +460,7 @@ export class LocalSessionStore {
             await this.meta.ensureLoaded();
             if (ownerRecorded(this.meta.state.entries.get(sessionId)))
                 return;
+            assertFirstOwnerWritable(sessionId, owner);
             const existed = await this.existsInRepo(sessionId);
             const claim = existed && owner !== null && ownerClaimWindowOpen();
             const wrote = await this.writeMeta(sessionId, (before) => {
@@ -580,17 +582,21 @@ export class LocalSessionStore {
     }
     async fork(sourceId, owner) {
         await this.meta.ensureLoaded();
-        try {
-            const session = await this.repo.fork({ id: sourceId, createdAt: "" }, {});
-            const id = (await session.getMetadata()).id;
-            await this.writeMeta(id, () => ({ incarnation: mintSessionIncarnation(), owner }));
-            return id;
-        }
-        catch (e) {
-            if (isNotFound(e))
-                return null;
-            throw e;
-        }
+        return this.withSessionWriteLock(sourceId, async () => {
+            const source = this.meta.state.entries.get(sourceId);
+            const forkOwner = forkOwnerOf(owner, source === undefined ? undefined : readSessionMetaCell(source).owner);
+            try {
+                const session = await this.repo.fork({ id: sourceId, createdAt: "" }, {});
+                const id = (await session.getMetadata()).id;
+                await this.writeMeta(id, () => (forkOwner === undefined ? mintSessionIncarnation() : { incarnation: mintSessionIncarnation(), owner: forkOwner }));
+                return id;
+            }
+            catch (e) {
+                if (isNotFound(e))
+                    return null;
+                throw e;
+            }
+        });
     }
     async exportEntries(sessionId) {
         if (!this.repo.exportEntries)
@@ -657,12 +663,15 @@ export class LocalSessionStore {
     }
     async commitStagedImport(sessionId, owner, staged, opts) {
         return this.withSessionWriteLock(sessionId, async () => {
+            const current = await this.metaOf(sessionId);
+            if (!ownerCellIs(opts.expectedOwner, current === undefined ? undefined : (current.owner ?? null)))
+                throw new StagedCommitOwnerChangedError(sessionId);
             const dstEntries = await this.exportEntries(sessionId);
             const rel = classifySyncRelationshipByIds(staged.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
-            if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
+            if ((rel.relation === "fork" || rel.relation === "stale") && opts.resolution !== "overwrite-dst") {
                 throw new SyncConflictError(sessionId, rel);
             }
-            if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstEntries !== null && dstEntries.length > 0) {
+            if (rel.relation === "fast_forward" && opts.resolution !== "overwrite-dst" && dstEntries !== null && dstEntries.length > 0) {
                 const dstSet = new Set(dstEntries.map((e) => e.id));
                 const diverged = fastForwardSharedContentDiverged(staged.filter((e) => dstSet.has(e.id)), dstEntries);
                 if (diverged)

package/dist/plugins/local-session-window.d.ts

@@ -16,12 +16,18 @@
  *    branch below the floor — so the record the engine reads is the one the run's walk reaches.
  * Read-only: the log is read once (`exportEntries`, pure), no append log is opened, and the window refuses writes.
  *
- * ## Cost: one linear walk
- * The branch is the `parentId` chain from the leaf — the chain core's `getPathToRoot` follows, with the same stop rule (an entry
- * without a parent ends it; a parent the log does not hold is `invalid_session`). It is walked here once, in linear time: core
- * 7.52.0 builds its path with `unshift` (quadratic in the branch length — seconds on a long session, on the event loop), and the
- * view must cost a window read, not a whole-branch walk. Every later read of the window goes through core's own walk, bounded by
- * the floor.
+ * ## Cost: one linear walk, the engine's
+ * The branch is core's own `getPathToRoot` over the whole log (the walk every engine read of a local session makes, with its stop
+ * rules: an entry without a parent ends it, a parent the log does not hold is `invalid_session`, an unknown leaf is `not_found`).
+ * Since core 7.54.0 (#2092) that walk is linear; before, it built the path with `unshift` (quadratic — seconds on a long session, on
+ * the event loop) and this module walked the `parentId` chain itself. The second walker is retired: the view reads the branch the
+ * engine reads, by the engine's reading. Every later read of the window goes through the same walk, bounded by the floor.
+ * A parent CYCLE (a corrupted log; the engine never writes one) is refused by that same walk: since core 7.54.1 it carries one
+ * `ParentChainGuard`, and the entry it stands on twice ends it with `invalid_session` naming that entry — `wake` refuses a looped log
+ * the way it refuses one whose parent is missing. Core 7.54.0's walk had no guard (a looped log spun it forever on the event loop,
+ * and the view's wake with it). The retired walker's own cycle refusal went with it: the engine's guard is the one refusal now, shared
+ * by `getPathToRoot` and the run's resume ancestor scan (the two walks core 7.54.1 guards; this module has no walker of its own left).
+ * Pinned in `test/session-log-parent-cycle.test.ts`.
  */
 import { BaseSessionStorage } from "@sema-agent/core";
 export declare class LocalSessionWindow extends BaseSessionStorage {

package/dist/plugins/local-session-window.js

@@ -30,25 +30,9 @@ export class LocalSessionWindow extends BaseSessionStorage {
         const metadata = (await repo.list()).find((m) => m.id === sessionId) ?? { id: sessionId, createdAt: new Date().toISOString() };
         const whole = new InMemorySessionStorage({ entries: log });
         const leafId = await whole.getLeafId();
-        const branch = await branchOf(whole, leafId, log.length);
+        const branch = await whole.getPathToRoot(leafId);
         const { tail, floorEntryId } = boundedTail(branch);
         return new LocalSessionWindow(metadata, tail, leafId, floorEntryId, branch.slice(0, branch.length - tail.length));
     }
 }
-async function branchOf(whole, leafId, logLength) {
-    const fromLeaf = [];
-    let current = leafId === null ? undefined : await whole.getEntry(leafId);
-    while (current) {
-        fromLeaf.push(current);
-        if (!current.parentId)
-            break;
-        if (fromLeaf.length > logLength)
-            throw new SessionError("invalid_session", `Entry ${current.id} is on a parent cycle`);
-        const parent = await whole.getEntry(current.parentId);
-        if (!parent)
-            throw new SessionError("invalid_session", `Entry ${current.parentId} not found`);
-        current = parent;
-    }
-    return fromLeaf.reverse();
-}
 //# sourceMappingURL=local-session-window.js.map

package/dist/plugins/one-time-migrations.d.ts

@@ -256,6 +256,17 @@
  *    箱的键;判官拒的 owner 持不了租(`ack` / `releaseLease` 照「不是持租者」答、`claimLease` 抛),存量那一格随租约到期失效;② MySQL 协议上带孤立代理的主体
  *    在升级前写下的箱 —— 驱动把孤立代理换成 U+FFFD 的三字节,库里的键与字面带 U+FFFD 的那只主体的键逐字节相同,判官收这只键 ⇒ 不删(挑出来就得删掉一只律认为
  *    存在的箱)。local 车道用引擎自己的 File 信箱(盘上格式归引擎)⇒ 恒 0。
+ *  · **M28 停驻行里的明文凭据原地封好**(7.134.0)—— 7.134.0 起提交体里请求面凭据位上的每一个值(闭集 `CHECKPOINT_CTX_CREDENTIAL_SLOTS` 与规则的属主
+ *    `http/checkpoint-ctx.ts` 末段「凭据位密封」;本处不重列)在 `checkpoint_ctx` 里只以封签存在,续跑上下文读口对凭据位上的明文答 409 `conflict.checkpoint_ctx_unsealable`(`reason:"plaintext"`)。升级之前写下的
+ *    行是明文 ⇒ **起服扫一遍、原地封好**:不在本文件的迁移段里(封要保管店的封签器,而本段跑在建店的 web-admin 运行时能交给它之前的店层 ——
+ *    与 M10 / M19 / M25 同为在本段之外跑的条目),编排在 `checkpoint-ctx-seal-m28.ts`(起服第 6 段,checkpoint 店建成之后、任何路由装配之前调一次),
+ *    店腿是两孪生各自的 `rewriteCtxRowsM28`(SQL:键集分页 + 按原文 CAS、`updated_at_ms` 不动;local:逐档原子重写、信封的 `updatedAt` 不动),
+ *    行改写是读写两侧同一只封口(`sealStoredCheckpointCtxM28`)。不删行、不改续跑语义;读不出的行计数不动;已封与不带凭据的行零写。读数不进
+ *    {@link OneTimeMigrationReport}(`reportKeys` 空,与 M25 同形),由起服 info 一行 `checkpoint_ctx_credentials_sealed` 说(扫了几行、封了几行几个值)。
+ *    窗外不扫。窗 = 发布日 + 30 天(与 M21 / M23 同一条论证:窗关时缺省部署上升级前停驻的行已被终局兜底收走);窗关之后仍是明文的行由读口的 `plaintext` 拒接住
+ *    (出路 = 重提)。**本条不覆盖混跑(如实登记)**:≤7.133.x 的续跑读者对凭据位上的封签值没有拒臂(读口、重放判据、店的形判都不看那一格,各消费者按「形不对」把它丢掉、
+ *    任务照跑),而它改写过的行与 7.134.0 副本新写的行都是封签 ⇒ 升级序是**先停光 ≤7.133.x 副本、再起第一个 7.134.0 副本**(本条在它起服时跑),回滚之前先结掉带凭据的停驻行
+ *    (随包 MIGRATION 7.134.0 第 1 条)。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒

package/dist/plugins/one-time-migrations.js

@@ -450,6 +450,18 @@ export const ONE_TIME_MIGRATIONS = [
             "或照 `docs/DEPLOY-PREREQS.md` 7.133.0 SQL 节的查法按键手工删",
         reportKeys: ["mailboxRejectedKeyRowsRemoved"],
     },
+    {
+        id: "M28",
+        introducedIn: "7.134.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 `src/checkpoint-ctx-seal-m28.ts` 整个文件与起服第 6 段对它的那一处调用;两孪生的店腿 `rewriteCtxRowsM28` 与读数型 `CtxRowsRewriteM28`;" +
+            "`http/checkpoint-ctx.ts` 的 `sealStoredCheckpointCtxM28`;`test/checkpoint-ctx-seal-m28.test.ts` 与 `test/checkpoint-ctx-credential-seal-db-integration.test.ts` 的 M28 格。" +
+            "**不随本条删**:凭据位密封的常设规则(封口 / 开口 / 闭集 / 读口第四态 / 409 码 / 装配期拒启)",
+        afterRemoval: "读口对凭据位上明文的常设拒臂接住:跳过了带本条的版本直接升的库,带明文凭据的停驻行续跑答 409 `conflict.checkpoint_ctx_unsealable`(`reason:\"plaintext\"`)," +
+            "行字节不动 —— 出路 = 作为新任务重提(仍停驻的先取消),或升级时先过一次带本条的版本",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;

package/dist/plugins/permission-rule-store-file.js

@@ -6,8 +6,7 @@ import { FileDurableRulePartitionProvider, AppendLog, ensureDir, } from "@sema-a
 import { z } from "zod";
 import { DurableRuleScopeSchema, buildRulePayloadHash } from "./permission-rule-store-sql.js";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
-import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
-import { RULE_BEHAVIORS } from "@sema-agent/core";
+import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, RULE_OWNER_KINDS, UNCOVERED_SEGMENT_REASONS } from "@sema-agent/core";
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
 const RuleCandidateSchema = z.object({ behavior: z.enum(RULE_BEHAVIORS), rule: z.string(), scope: DurableRuleScopeSchema }).strict();
 const RuleOffer2Schema = z.union([
@@ -22,14 +21,19 @@ const RuleOffer2Schema = z.union([
     })
         .strict(),
 ]);
+const OWNER_SHAPE_BY_KIND = {
+    principal: z.object({ kind: z.literal("principal"), principal: z.string() }).strict(),
+    "local-owner": z.object({ kind: z.literal("local-owner") }).strict(),
+};
+const RuleOwnerSchema = z.union([OWNER_SHAPE_BY_KIND.principal, OWNER_SHAPE_BY_KIND["local-owner"]]);
 const ApprovalRecordSchema = z
     .object({
     id: z.string().min(1),
     principal: z.string().optional(),
-    owner: z.union([z.object({ kind: z.literal("principal"), principal: z.string() }).strict(), z.object({ kind: z.literal("local-owner") }).strict()]).optional(),
+    owner: RuleOwnerSchema.optional(),
     schema: z.literal(RULE_APPROVAL_RECORD_SCHEMA),
-    kind: z.enum(["card", "import", "starter"]),
-    state: z.enum(["pending", "approved", "redeemed"]),
+    kind: z.enum(RULE_APPROVAL_KINDS),
+    state: z.enum(RULE_APPROVAL_STATES),
     candidates: z.array(RuleCandidateSchema),
     offers: z.array(RuleOffer2Schema),
     createdAt: z.string(),
@@ -72,7 +76,7 @@ const StaleApprovalRowSchema = z
     id: z.string().min(1),
     schema: z.unknown().optional(),
     principal: z.string().optional(),
-    owner: z.union([z.object({ kind: z.literal("principal"), principal: z.string() }).strict(), z.object({ kind: z.literal("local-owner") }).strict()]).optional(),
+    owner: RuleOwnerSchema.optional(),
 })
     .loose();
 const StaleApprovalLineSchema = z.object({ op: z.literal("put"), record: StaleApprovalRowSchema }).loose();

package/dist/plugins/permission-rule-store-sql.js

@@ -1,10 +1,10 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, isValidDurableScope, parseRuleText, readRowBehavior, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_BEHAVIORS, RULE_SYNC_DROP_CODES, EMPTY_DURABLE_RULE_PARTITION, } from "@sema-agent/core";
+import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, isValidDurableScope, parseRuleText, readRowBehavior, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_ADD_ORIGINS, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, RULE_SYNC_DROP_CODES, EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, EMPTY_DURABLE_RULE_PARTITION, } from "@sema-agent/core";
 import { dialectProtocolJsonEncoder, sqlDbNowMs, SQL_DB_NOW_MS } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
-import { canonicalJson } from "../canonical-json.js";
-import { EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, isPersistedRuleTool, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
+import { canonicalJsonStringify } from "@sema-agent/core";
+import { isPersistedRuleTool } from "../permission-rule-vocab.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { createZodColumnReader, decodeJsonColumn, foldJsonColumn, jsonColumnText, readJsonObjectColumn, SqlJsonColumnError } from "./sql-json-column.js";
 import { redactSecrets } from "../trace/redact.js";
@@ -25,7 +25,7 @@ export const DurableRuleScopeSchema = z.union([
 ]);
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
 const RuleAddSchema = z
-    .object({ dot: RuleDotSchema, origin: z.enum(["user", "imported-cc", "starter"]), createdAt: z.string() })
+    .object({ dot: RuleDotSchema, origin: z.enum(RULE_ADD_ORIGINS), createdAt: z.string() })
     .strict();
 const PersistedRuleRowSchema = z
     .object({
@@ -336,7 +336,7 @@ export function buildRuleOwnerKey(owner) {
     return createHash("sha256").update(material, "utf8").digest("hex");
 }
 export function buildRuleBucketChecksum(body) {
-    return `sha256:${createHash("sha256").update(canonicalJson(body), "utf8").digest("hex")}`;
+    return `sha256:${createHash("sha256").update(canonicalJsonStringify(body), "utf8").digest("hex")}`;
 }
 const NEXT_DOT_MAX_ATTEMPTS = 8;
 const EMPTY_BUCKET = { actor: "", counter: 0, rev: 0, rules: [], tombstones: [], quarantined: [] };
@@ -586,8 +586,8 @@ export class SqlRuleApprovalRecordStore {
         const offers = decodeJsonColumn(row.offers_json, readOffersJson, `${at}.offers_json`);
         const dotsRaw = row.redeemed_dots_json === null || row.redeemed_dots_json === undefined ? undefined : decodeJsonColumn(row.redeemed_dots_json, readRedeemedDotsJson, `${at}.redeemed_dots_json`);
         const edited = row.edited_json === null || row.edited_json === undefined ? undefined : decodeJsonColumn(row.edited_json, readEditedJson, `${at}.edited_json`);
-        const kind = z.enum(["card", "import", "starter"]).safeParse(row.kind);
-        const state = z.enum(["pending", "approved", "redeemed"]).safeParse(row.state);
+        const kind = z.enum(RULE_APPROVAL_KINDS).safeParse(row.kind);
+        const state = z.enum(RULE_APPROVAL_STATES).safeParse(row.state);
         if (!kind.success || !state.success) {
             throw new Error(`${PERMISSION_RULE_APPROVAL_TABLE} row ${id} carries an unreadable kind/state (${String(row.kind)}/${String(row.state)})`);
         }
@@ -662,7 +662,7 @@ export class SqlRuleApprovalRecordStore {
 }
 export const RULE_IMPORT_TICKET_GC_GRACE_MS = 10 * 60_000;
 export function buildRulePayloadHash(candidates) {
-    return createHash("sha256").update(canonicalJson(candidates), "utf8").digest("hex");
+    return createHash("sha256").update(canonicalJsonStringify(candidates), "utf8").digest("hex");
 }
 export class SqlRuleImportTicketStore {
     db;

package/dist/plugins/pg-session-storage.d.ts

@@ -149,7 +149,7 @@ export declare class PgSessionStore implements SessionStore {
     recordInstructionSource(sessionId: string, expected: InstructionSourceBaseline, source: string | null): Promise<void>;
     /** @see TiDBSessionStore.fork — copy the WHOLE durable history (full session_event log, compaction floor bypassed,
      *  NOT wake's bounded tail) to a NEW uuidv7 session, re-seq dense from 0, ids/parents verbatim, owner=caller. */
-    fork(sourceId: string, owner: string | null): Promise<string | null>;
+    fork(sourceId: string, owner?: string | null): Promise<string | null>;
     /** @see TiDBSessionStore.exportEntries — 2c session-sync EXPORT: the FULL durable session_event log (compaction floor
      *  bypassed, NOT wake's tail) as `SessionTreeEntry[]`, oldest-first, verbatim. null if the source is unknown. */
     exportEntries(sessionId: string): Promise<SessionTreeEntry[] | null>;

package/dist/plugins/pg-session-storage.js

@@ -1,5 +1,5 @@
 import { emitLeafAdvance } from "../session-leaf-bus.js";
-import { BaseSessionStorage, StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry, } from "@sema-agent/core";
+import { BaseSessionStorage, StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry, admitSessionPlacement, } from "@sema-agent/core";
 import { SESSION_TITLE_MAX_CHARS } from "../session-row.js";
 import { escapeLike } from "./sql-escape.js";
 import { decodeSessionEventPayload } from "./session-event-payload.js";
@@ -7,16 +7,17 @@ import { scanEpochAnchor } from "./session-epoch-anchor.js";
 import { jsonColumnText } from "./sql-json-column.js";
 import { pgSafeJsonStringify } from "./pg-safe-json.js";
 import { toIso } from "./sql-row-helpers.js";
-import { assertPlacementAdmission, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
+import { placementCapabilityOf, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, createPlacedSessionRow } from "../delegated-session-owner.js";
 import { createLogger } from "../observability/logger.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
+import { classifySyncRelationshipByIds, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
 import { isPgUniqueViolation } from "./sql-errors.js";
 import { BASELINE_IO_DEADLINE_MS, decodeInstructionSource, encodeInstructionSource } from "../instruction-source-notice.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { SESSION_META_INCARNATION_COLUMN, carriedIncarnation, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { ensureIndexes } from "./ensure-index.js";
+import { assertFirstOwnerWritable, forkOwnerOf } from "./session-ownership.js";
 const isDupKey = isPgUniqueViolation;
 function baselineQuery(text, values) {
     return { text, values, query_timeout: BASELINE_IO_DEADLINE_MS };
@@ -193,7 +194,7 @@ export class PgSessionStore {
         const inflight = this.pending.get(sessionId);
         if (inflight) {
             const acquired = await inflight;
-            assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
+            admitSessionPlacement(sessionId, await this.placementOf(sessionId), opts ?? {}, placementCapabilityOf(this));
             return acquired;
         }
         const p = this.load(sessionId, false, opts).finally(() => this.pending.delete(sessionId));
@@ -203,7 +204,7 @@ export class PgSessionStore {
     async load(sessionId, requireExisting = false, opts) {
         let storage = await PgSessionStorage.wake(this.pool, sessionId);
         if (storage) {
-            assertPlacementAdmission(sessionId, (await storage.getMetadata()).placement, opts);
+            admitSessionPlacement(sessionId, (await storage.getMetadata()).placement, opts ?? {}, placementCapabilityOf(this));
             return { session: new StoredSession(storage), sessionId };
         }
         if (requireExisting)
@@ -213,10 +214,15 @@ export class PgSessionStore {
         if (!storage) {
             throw new SessionError("storage", `session ${sessionId} vanished between register and wake (a concurrent purge won the race) — retry`);
         }
-        assertPlacementAdmission(sessionId, (await storage.getMetadata()).placement, opts);
+        admitSessionPlacement(sessionId, (await storage.getMetadata()).placement, opts ?? {}, placementCapabilityOf(this));
         return { session: new StoredSession(storage), sessionId };
     }
     async register(sessionId, owner) {
+        if (typeof owner !== "string" && owner !== null) {
+            if ((await this.ownerOf(sessionId)) !== undefined)
+                return;
+            assertFirstOwnerWritable(sessionId, owner);
+        }
         await this.insertMeta(sessionId, owner, undefined);
     }
     async createOnAcquire(sessionId, placement) {
@@ -429,10 +435,11 @@ export class PgSessionStore {
         }
     }
     async fork(sourceId, owner) {
-        const metaRes = await this.pool.query("SELECT leaf_id FROM session_meta WHERE session_id = $1", [sourceId]);
+        const metaRes = await this.pool.query("SELECT leaf_id, owner FROM session_meta WHERE session_id = $1", [sourceId]);
         if (!metaRes.rows[0])
             return null;
         const leafId = metaRes.rows[0].leaf_id ?? null;
+        const forkOwner = forkOwnerOf(owner, metaRes.rows[0].owner ?? null) ?? null;
         const eventRes = await this.pool.query(`SELECT entry_id, parent_id, type, ${jsonColumnText("pg", "payload")}, ts FROM session_event WHERE session_id = $1 ORDER BY seq ASC`, [sourceId]);
         const rows = eventRes.rows;
         const newId = uuidv7();
@@ -445,7 +452,7 @@ export class PgSessionStore {
                 const payload = String(r.payload);
                 await conn.query("INSERT INTO session_event (session_id, seq, entry_id, parent_id, type, payload, ts) VALUES ($1,$2,$3,$4,$5,$6::jsonb,$7)", [newId, seq, r.entry_id, r.parent_id ?? null, r.type, payload, r.ts]);
             }
-            await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES ($1,$2,$3,$4,$5,$6,$7)", [newId, owner, now, now, leafId, rows.length, mintSessionIncarnation()]);
+            await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES ($1,$2,$3,$4,$5,$6,$7)", [newId, forkOwner, now, now, leafId, rows.length, mintSessionIncarnation()]);
             await conn.query("COMMIT");
             return newId;
         }
@@ -642,6 +649,23 @@ class PgStagingHandle {
         const conn = await this.pool.connect();
         try {
             await conn.query("BEGIN");
+            const now = new Date();
+            const minted = mintSessionIncarnation();
+            if (opts.expectedOwner !== undefined) {
+                const cas = await conn.query("UPDATE session_meta SET leaf_seq = leaf_seq + 1 WHERE session_id = $1 AND owner IS NOT DISTINCT FROM $2", [this.realSessionId, opts.expectedOwner]);
+                if (cas.rowCount !== 1) {
+                    await conn.query("ROLLBACK");
+                    throw new StagedCommitOwnerChangedError(this.realSessionId);
+                }
+            }
+            else {
+                await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES ($1,$2,$3,$4,NULL,0,$5) ON CONFLICT (session_id) DO NOTHING", [this.realSessionId, owner, now, now, minted]);
+                const claimed = await conn.query("SELECT incarnation FROM session_meta WHERE session_id = $1 FOR UPDATE", [this.realSessionId]);
+                if (String(claimed.rows[0]?.incarnation) !== minted) {
+                    await conn.query("ROLLBACK");
+                    throw new StagedCommitOwnerChangedError(this.realSessionId);
+                }
+            }
             const staged = await conn.query("SELECT entry_id FROM session_event WHERE session_id = $1 ORDER BY seq ASC FOR UPDATE", [this.stagingId]);
             const dst = await conn.query("SELECT entry_id FROM session_event WHERE session_id = $1 ORDER BY seq ASC FOR UPDATE", [this.realSessionId]);
             const dstMeta = await conn.query("SELECT placement_kind FROM session_meta WHERE session_id = $1", [this.realSessionId]);
@@ -650,15 +674,15 @@ class PgStagingHandle {
                 throw new SessionError("placement_refused", `session ${this.realSessionId} belongs to the ${dstMeta.rows[0].placement_kind} placement partition — a session-sync staged commit cannot overwrite a delegation transcript`);
             }
             const srcIds = staged.rows.map((r) => String(r.entry_id));
-            const dstIds = dstMeta.rows.length > 0 ? dst.rows.map((r) => String(r.entry_id)) : null;
+            const dstIds = opts.expectedOwner !== undefined ? dst.rows.map((r) => String(r.entry_id)) : null;
             const rel = classifySyncRelationshipByIds(srcIds, dstIds);
-            if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
+            if ((rel.relation === "fork" || rel.relation === "stale") && opts.resolution !== "overwrite-dst") {
                 await conn.query("ROLLBACK");
                 throw new SyncConflictError(this.realSessionId, rel);
             }
-            if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
-                const dstFull = await conn.query(`SELECT seq, ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 ORDER BY seq ASC`, [this.realSessionId]);
-                const stagedFull = await conn.query(`SELECT entry_id, ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 ORDER BY seq ASC`, [this.stagingId]);
+            if (rel.relation === "fast_forward" && opts.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
+                const dstFull = await conn.query(`SELECT seq, ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 ORDER BY seq ASC FOR UPDATE`, [this.realSessionId]);
+                const stagedFull = await conn.query(`SELECT entry_id, ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 ORDER BY seq ASC FOR UPDATE`, [this.stagingId]);
                 const dstSet = new Set(dstIds);
                 const dstEntries = dstFull.rows.map((r) => decodeSessionEventPayload(r.payload, this.realSessionId, r.seq));
                 const stagedShared = stagedFull.rows.filter((r) => dstSet.has(String(r.entry_id))).map((r) => decodeSessionEventPayload(r.payload, this.stagingId, r.entry_id));
@@ -670,13 +694,11 @@ class PgStagingHandle {
             }
             await conn.query("DELETE FROM session_event WHERE session_id = $1", [this.realSessionId]);
             await conn.query("UPDATE session_event SET session_id = $1 WHERE session_id = $2", [this.realSessionId, this.stagingId]);
-            const lastRes = await conn.query(`SELECT ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 ORDER BY seq DESC LIMIT 1`, [this.realSessionId]);
+            const lastRes = await conn.query(`SELECT ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 ORDER BY seq DESC LIMIT 1 FOR UPDATE`, [this.realSessionId]);
             let leafId = null;
             if (lastRes.rows[0])
                 leafId = leafIdAfterEntry(decodeSessionEventPayload(lastRes.rows[0].payload, this.realSessionId, "last staged row"));
-            const now = new Date();
-            await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES ($1,$2,$3,$4,$5,$6,$7) " +
-                "ON CONFLICT (session_id) DO UPDATE SET owner = EXCLUDED.owner, updated_at = EXCLUDED.updated_at, leaf_id = EXCLUDED.leaf_id, leaf_seq = EXCLUDED.leaf_seq", [this.realSessionId, owner, now, now, leafId, srcIds.length, mintSessionIncarnation()]);
+            await conn.query("UPDATE session_meta SET owner = $1, updated_at = $2, leaf_id = $3, leaf_seq = $4 WHERE session_id = $5", [owner, now, leafId, srcIds.length, this.realSessionId]);
             const afterMeta = await conn.query("SELECT placement_kind, owner, incarnation FROM session_meta WHERE session_id = $1", [this.realSessionId]);
             if (afterMeta.rows[0]?.placement_kind != null) {
                 await conn.query("ROLLBACK");

package/dist/plugins/remote-env-device.d.ts

@@ -17,10 +17,9 @@ type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
  * 🔴 三条不许折错的线:
  *  ① `outcome_unknown` **原样过境**——core 把它排除在 `RETRYABLE_REMOTE_ERROR_CODES` 之外正是为了
  *     「可能已经执行过」这一格;折成 `timeout`/`transport_lost` 会让上层按可重试处理,重驱已提交副作用。
- *  ② `target_unavailable`(never-started 的诚实词)在 `FileErrorCode` 上**没有对位词** —— 落
- *     `transport_lost`:它的契约是「连接故事已知、重连后可重试」,而 never-started 的重试确实是安全的。
- *     诚实残余:file 面因此**分不出**「从未开始」与「传输中断」,两者都落在同一个可重试桶里(方向对、
- *     粒度粗)。要分得开需要 core 在 `FileErrorCode` 上补 never-started 词 —— 已作 O12 的后续请托登记。
+ *  ② `target_unavailable`(never-started 的诚实词)**原样过境** —— core 7.54.0([ref] r3)给 `FileErrorCode` 补了同名词
+ *     (目标在 commit 前拒、从未开始、零效果,目标回来后重试安全;写车道据它撤回首触记录、不计 edited)。修前文件面无对位词,
+ *     落 `transport_lost`(「传输中断」= 重试白名单读作「可能已执行」),file 面分不出「从未开始」与「传输中断」—— 那条 O12 后续请托随本版兑现。
  *  ③ exec 专属词(`shell_unavailable`/`spawn_error`/`callback_error`/`suspended`/`auth_failed`)出现在
  *     file 面上是**设备端协议违约**(它把一个 exec 结局贴到一次文件操作上)⇒ 落 `unknown`,不猜。
  */
@@ -38,9 +37,8 @@ type RejectCode = DeviceRejectCode;
 /**
  * 汇聚端的 **typed 拒**(投递门**之前**,§5.3 投递边界:设备从未可能见过这条指令)→ core 错误码。
  *
- * 🔴 全部落在**可安全重试**的那一侧,这是投递边界给的硬事实,不是乐观估计。exec 面用 O12 的
- * `target_unavailable`(「目标在 commit 前拒了,命令从未启动」的诚实词);file 面无对位词,同上落
- * `transport_lost`。
+ * 🔴 全部落在**可安全重试**的那一侧,这是投递边界给的硬事实,不是乐观估计。exec 面与 file 面用同一个
+ * `target_unavailable`(「目标在 commit 前拒了,指令从未启动」的诚实词;file 面自 core 7.54.0 起有它,修前落 `transport_lost`)。
  * 例外 `identity_mismatch` / `revoked` / `not_found`:那是**永久**拒(换设备/吊销/不是你的),重试
  * 只会同样失败 —— exec 面落 `auth_failed`(NEVER retry 的那一格),file 面无对位词落 `permission_denied`
  * (「这条路你走不通,而且不是暂时的」是它最近的语义)。
@@ -324,6 +322,15 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
  *  ③ 「这个 placement 根本没绑设备」是**装配/准入错误**,不是一次运行期业务拒绝 —— 响亮抛,让 spawn
  *     失败(core 对 `isolation:"worktree"` 的同款姿势:宁可 throw,绝不静默给一个不对的 env)。
  *     对比:「绑了但现在不在线」是运行期事实 ⇒ 构造成功,`connect()` 回 typed `device.offline`。
+ *
+ * 🔴 **工厂的每一只拒都是 typed 拒**(core 7.54.0 [ref] r3 契约:工厂抛的 `.code` 原样成失败终局的码):经 {@link deviceFactoryRefusal} 一处铸,码取
+ * `DEVICE_ERROR_CODES` 闭集(装配错误取 `config.placement_root_invalid`),句子里的 `[码]` 与 `.code` 同值。修前抛裸 `Error`,码只在句子里。
+ *
+ * 🔴 **续跑腿的投递围栏**(core 7.54.0 [ref] r3 / #2061,`ExecutionEnvFactoryContext.resumeWorkspace`):行记下了设备(`resumeWorkspace.deviceId`)⇒
+ * 本工厂**只**在那台设备上铸 —— placement 根此刻绑的不是它(换绑过)⇒ 抛 typed `device.identity_mismatch`(换绑后赎回的同一个词,零新码),
+ * 句子点名两台设备;不连另一台、不改道(新设备没有那个工作区)。读当前绑定只为判出这一拒与取属主,铸的设备恒是行记下的那一台。
+ * 「绑的就是它但现在不在线」与新跑同形:构造成功、`connect()` 回 typed `device.offline`(从不连别的设备)。
+ * 行没记设备(非设备车道 / 早于该字段的行)⇒ 不声明要兑现的设备,按普通路由走。句柄(`workspaceHandle()`)恒报连接真到达的设备,不抄 `resumeWorkspace`。
  */
 export declare function deviceExecutionEnvFactory(deps: DeviceEnvFactoryDeps): ExecutionEnvFactory;
 /**

package/dist/plugins/remote-env-device.js

@@ -22,7 +22,7 @@ export const DEVICE_OUTCOME_TO_FILE_ERROR = {
     shell_unavailable: "unknown",
     spawn_error: "unknown",
     suspended: "unknown",
-    target_unavailable: "transport_lost",
+    target_unavailable: "target_unavailable",
     timeout: "timeout",
     transport_lost: "transport_lost",
     unknown: "unknown",
@@ -66,20 +66,20 @@ export const DEVICE_REJECT_TO_EXEC_ERROR = {
     "draining": "target_unavailable",
 };
 export const DEVICE_REJECT_TO_FILE_ERROR = {
-    "device.not_bound": "transport_lost",
-    "device.offline": "transport_lost",
-    "device.busy": "transport_lost",
-    "device.attached_elsewhere": "transport_lost",
-    "device.claim_conflict": "transport_lost",
+    "device.not_bound": "target_unavailable",
+    "device.offline": "target_unavailable",
+    "device.busy": "target_unavailable",
+    "device.attached_elsewhere": "target_unavailable",
+    "device.claim_conflict": "target_unavailable",
     "device.provider_mismatch": "permission_denied",
     "device.identity_mismatch": "permission_denied",
     "device.revoked": "permission_denied",
     "device.enrollment_invalid": "permission_denied",
     "not_found.device": "permission_denied",
-    "device.rebind_rev_conflict": "transport_lost",
-    "device.rebind_active_run": "transport_lost",
-    "limit.rate_exceeded": "transport_lost",
-    "draining": "transport_lost",
+    "device.rebind_rev_conflict": "target_unavailable",
+    "device.rebind_active_run": "target_unavailable",
+    "limit.rate_exceeded": "target_unavailable",
+    "draining": "target_unavailable",
 };
 const DEVICE_REJECT_TO_REMOTE_ERROR = {
     "device.not_bound": "connect_failed",
@@ -232,7 +232,7 @@ export class RemoteDeviceExecutionEnv {
                 failure: {
                     remote: "connect_failed",
                     exec: "target_unavailable",
-                    file: "transport_lost",
+                    file: "target_unavailable",
                     message: `[device.admission_unavailable] the device admission read failed, so this session's device could not be confirmed (fail-closed): ${err instanceof Error ? err.message : String(err)}`,
                 },
             };
@@ -780,25 +780,33 @@ const OUTCOME_TO_REMOTE_ERROR = {
     transport_lost: "transport_lost",
     unknown: "unknown",
 };
+function deviceFactoryRefusal(code, message) {
+    return Object.assign(new Error(message), { code });
+}
 export function deviceExecutionEnvFactory(deps) {
     const execTimeoutMs = deps.execTimeoutMs ?? 1_800_000;
     return async (ctx) => {
         const rootSessionId = ctx.placementRootSessionId;
         if (typeof rootSessionId !== "string" || rootSessionId.length === 0) {
-            throw new Error("device lane: ExecutionEnvFactoryContext.placementRootSessionId is empty [config.placement_root_invalid] — " +
+            throw deviceFactoryRefusal("config.placement_root_invalid", "device lane: ExecutionEnvFactoryContext.placementRootSessionId is empty [config.placement_root_invalid] — " +
                 "the device placement is keyed on the run tree's placement root; defaulting to the child sessionId would read as a NEW placement (v2 §4.3.2 / core design/380 O1①)");
         }
         const binding = await deps.store.getSessionBinding(rootSessionId);
         if (!binding) {
-            throw new Error(`device lane: no device binding for placement root ${rootSessionId} [${DEVICE_ERROR_CODES.NOT_BOUND}] — ` +
+            throw deviceFactoryRefusal(DEVICE_ERROR_CODES.NOT_BOUND, `device lane: no device binding for placement root ${rootSessionId} [${DEVICE_ERROR_CODES.NOT_BOUND}] — ` +
                 "the submit-time admission chain must bind the root session to a device before a run reaches the factory (v2 §4.3.2)");
         }
+        const recordedDevice = ctx.resumeWorkspace?.deviceId;
+        if (recordedDevice !== undefined && recordedDevice !== binding.deviceId) {
+            throw deviceFactoryRefusal(DEVICE_ERROR_CODES.IDENTITY_MISMATCH, `device lane: this resume rebuilds the workspace on device ${recordedDevice}, but placement root ${rootSessionId} is now bound to ${binding.deviceId} [${DEVICE_ERROR_CODES.IDENTITY_MISMATCH}] — ` +
+                "a parked call does not follow a rebind (the new device has no copy of that workspace); finish or cancel the parked task, then start it again on the device now bound");
+        }
         const view = await deps.store.readDeviceForAdmission(binding.deviceId, binding.owner);
         if (!view) {
-            throw new Error(`device lane: the bound device is gone or not owned by the binding's principal [${DEVICE_ERROR_CODES.NOT_FOUND}]`);
+            throw deviceFactoryRefusal(DEVICE_ERROR_CODES.NOT_FOUND, `device lane: the bound device is gone or not owned by the binding's principal [${DEVICE_ERROR_CODES.NOT_FOUND}]`);
         }
         if (view.row.status === "revoked") {
-            throw new Error(`device lane: the bound device has been revoked [${DEVICE_ERROR_CODES.REVOKED}] — revocation is terminal; re-enrolling mints a NEW deviceId (v2 §8-R4)`);
+            throw deviceFactoryRefusal(DEVICE_ERROR_CODES.REVOKED, `device lane: the bound device has been revoked [${DEVICE_ERROR_CODES.REVOKED}] — revocation is terminal; re-enrolling mints a NEW deviceId (v2 §8-R4)`);
         }
         assertPosixDevicePlatform(view.row.platformOs, view.row.deviceId);
         return new RemoteDeviceExecutionEnv({

package/dist/plugins/session-ownership.d.ts

@@ -0,0 +1,11 @@
+/**
+ * fork 拷贝的属主 —— core `SessionStore.fork` 契约的唯一读法:
+ * 显式串 ⇒ 该串;无参 / 显式 `null` ⇒ 源会话记下的属主(`undefined` = 源会话没记,拷贝也不记)。
+ */
+export declare function forkOwnerOf(requested: string | null | undefined, sourceOwner: string | null | undefined): string | null | undefined;
+/**
+ * `register` 首写的 owner 守卫 —— core `SessionStore.register` 契约的唯一读法(三只店同调):首写的 owner 既不是串也不是 `null` ⇒ 响亮拒(不留行);
+ * 「首写」由调用方判(已记下属主的会话上的调用照旧静默不改,不经这里)。
+ */
+export declare function assertFirstOwnerWritable(sessionId: string, owner: unknown): asserts owner is string | null;
+//# sourceMappingURL=session-ownership.d.ts.map

package/dist/plugins/session-ownership.js

@@ -0,0 +1,11 @@
+import { SessionError } from "@sema-agent/core";
+export function forkOwnerOf(requested, sourceOwner) {
+    return typeof requested === "string" ? requested : sourceOwner;
+}
+export function assertFirstOwnerWritable(sessionId, owner) {
+    if (typeof owner === "string" || owner === null)
+        return;
+    throw new SessionError("storage", `register(${sessionId}): a first ownership write must carry a principal (string) or null (anonymous), got ${owner === undefined ? "undefined" : typeof owner} — ` +
+        "a stored value that ownerOf reads back as 'no row' would leave the session claimable forever and ownable never; refusing, nothing written");
+}
+//# sourceMappingURL=session-ownership.js.map